mirror of
https://github.com/google/nomulus.git
synced 2025-08-04 08:52:12 +02:00
Move AuthenticatedRegistrarAccessor to request/auth/
It is starting to be used in more places than just ur/server/registrar. Even now it's used in the RDAP, and we are going to start using it for the registrar-xhr endpoint meaning it will be used in EPP flows as well. Also logically - this is part of the request authentication. While moving - we also refactor it to make it easier to use in tests. Instead of mocking, we will be able to create instances with arbitrary roles. ------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=221645055
This commit is contained in:
guyben
jianglai
parent
b317aab22f
commit
6586460f3e
15 changed files with 173 additions and 159 deletions
|
|
@ -14,6 +14,7 @@ java_library(
|
|||
"//java/google/registry/ui/forms",
|
||||
"//java/google/registry/ui/server",
|
||||
"//javatests/google/registry/testing",
|
||||
"@com_google_guava",
|
||||
"@com_google_truth",
|
||||
"@com_google_truth_extensions_truth_java8_extension",
|
||||
"@junit",
|
||||
|
|
|
|||
|
|
@ -1,375 +0,0 @@
|
|||
// Copyright 2018 The Nomulus Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package google.registry.ui.server.registrar;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static google.registry.testing.AppEngineRule.THE_REGISTRAR_GAE_USER_ID;
|
||||
import static google.registry.testing.DatastoreHelper.loadRegistrar;
|
||||
import static google.registry.testing.DatastoreHelper.persistResource;
|
||||
import static google.registry.testing.JUnitBackports.assertThrows;
|
||||
import static google.registry.testing.LogsSubject.assertAboutLogs;
|
||||
import static google.registry.ui.server.registrar.AuthenticatedRegistrarAccessor.Role.ADMIN;
|
||||
import static google.registry.ui.server.registrar.AuthenticatedRegistrarAccessor.Role.OWNER;
|
||||
import static org.mockito.Matchers.any;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.verify;
|
||||
import static org.mockito.Mockito.verifyNoMoreInteractions;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
||||
import com.google.appengine.api.users.User;
|
||||
import com.google.common.flogger.LoggerConfig;
|
||||
import com.google.common.testing.NullPointerTester;
|
||||
import com.google.common.testing.TestLogHandler;
|
||||
import google.registry.groups.GroupsConnection;
|
||||
import google.registry.request.HttpException.ForbiddenException;
|
||||
import google.registry.request.auth.AuthLevel;
|
||||
import google.registry.request.auth.AuthResult;
|
||||
import google.registry.request.auth.UserAuthInfo;
|
||||
import google.registry.testing.AppEngineRule;
|
||||
import google.registry.testing.InjectRule;
|
||||
import java.util.logging.Level;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import org.junit.After;
|
||||
import org.junit.Before;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
|
||||
/** Unit tests for {@link AuthenticatedRegistrarAccessor}. */
|
||||
@RunWith(JUnit4.class)
|
||||
public class AuthenticatedRegistrarAccessorTest {
|
||||
|
||||
@Rule public final AppEngineRule appEngine = AppEngineRule.builder().withDatastore().build();
|
||||
@Rule public final InjectRule inject = new InjectRule();
|
||||
|
||||
private final HttpServletRequest req = mock(HttpServletRequest.class);
|
||||
private final HttpServletResponse rsp = mock(HttpServletResponse.class);
|
||||
private final GroupsConnection groupsConnection = mock(GroupsConnection.class);
|
||||
private final TestLogHandler testLogHandler = new TestLogHandler();
|
||||
|
||||
private static final AuthResult AUTHORIZED_USER = createAuthResult(true, false);
|
||||
private static final AuthResult UNAUTHORIZED_USER = createAuthResult(false, false);
|
||||
private static final AuthResult AUTHORIZED_ADMIN = createAuthResult(true, true);
|
||||
private static final AuthResult UNAUTHORIZED_ADMIN = createAuthResult(false, true);
|
||||
private static final AuthResult NO_USER = AuthResult.create(AuthLevel.NONE);
|
||||
private static final String SUPPORT_GROUP = "support@registry.example";
|
||||
private static final String DEFAULT_CLIENT_ID = "TheRegistrar";
|
||||
private static final String ADMIN_CLIENT_ID = "NewRegistrar";
|
||||
|
||||
private static AuthResult createAuthResult(boolean isAuthorized, boolean isAdmin) {
|
||||
return AuthResult.create(
|
||||
AuthLevel.USER,
|
||||
UserAuthInfo.create(
|
||||
new User(
|
||||
String.format(
|
||||
"%s_%s@gmail.com", isAuthorized ? "good" : "evil", isAdmin ? "admin" : "user"),
|
||||
"gmail.com",
|
||||
isAuthorized ? THE_REGISTRAR_GAE_USER_ID : "badGaeUserId"),
|
||||
isAdmin));
|
||||
}
|
||||
|
||||
@Before
|
||||
public void before() {
|
||||
LoggerConfig.getConfig(AuthenticatedRegistrarAccessor.class).addHandler(testLogHandler);
|
||||
persistResource(loadRegistrar(ADMIN_CLIENT_ID));
|
||||
when(groupsConnection.isMemberOfGroup(any(), any())).thenReturn(false);
|
||||
}
|
||||
|
||||
@After
|
||||
public void after() {
|
||||
LoggerConfig.getConfig(AuthenticatedRegistrarAccessor.class).removeHandler(testLogHandler);
|
||||
}
|
||||
|
||||
private String formatMessage(String message, AuthResult authResult, String clientId) {
|
||||
return message
|
||||
.replace("{user}", authResult.userIdForLogging())
|
||||
.replace("{clientId}", String.valueOf(clientId));
|
||||
}
|
||||
|
||||
/** Users only have access to the registrars they are a contact for. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_authorizedUser() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
AUTHORIZED_USER, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles())
|
||||
.containsExactly(DEFAULT_CLIENT_ID, OWNER);
|
||||
}
|
||||
|
||||
/** Users in support group have admin access to everything. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_authorizedUser_isSupportGroup() {
|
||||
when(groupsConnection.isMemberOfGroup("good_user@gmail.com", SUPPORT_GROUP)).thenReturn(true);
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
AUTHORIZED_USER, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles())
|
||||
.containsExactly(
|
||||
DEFAULT_CLIENT_ID, OWNER,
|
||||
DEFAULT_CLIENT_ID, ADMIN,
|
||||
ADMIN_CLIENT_ID, ADMIN);
|
||||
}
|
||||
|
||||
/** Logged out users don't have access to anything. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_loggedOutUser() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
NO_USER, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles()).isEmpty();
|
||||
}
|
||||
|
||||
/** Unauthorized users don't have access to anything. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_unauthorizedUser() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
UNAUTHORIZED_USER, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles()).isEmpty();
|
||||
}
|
||||
|
||||
/** Unauthorized users who are in support group have admin access. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_unauthorizedUser_inSupportGroup() {
|
||||
when(groupsConnection.isMemberOfGroup("evil_user@gmail.com", SUPPORT_GROUP)).thenReturn(true);
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
UNAUTHORIZED_USER, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles())
|
||||
.containsExactly(
|
||||
DEFAULT_CLIENT_ID, ADMIN,
|
||||
ADMIN_CLIENT_ID, ADMIN);
|
||||
}
|
||||
|
||||
/** Empty Support group email - skips check. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_emptySupportEmail_works() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(AUTHORIZED_USER, ADMIN_CLIENT_ID, "", groupsConnection);
|
||||
|
||||
verifyNoMoreInteractions(groupsConnection);
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles())
|
||||
.containsExactly(DEFAULT_CLIENT_ID, OWNER);
|
||||
}
|
||||
|
||||
/** Support group check throws - continue anyway. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_throwingGroupCheck_stillWorks() {
|
||||
when(groupsConnection.isMemberOfGroup(any(), any())).thenThrow(new RuntimeException("blah"));
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
AUTHORIZED_USER, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
verify(groupsConnection).isMemberOfGroup("good_user@gmail.com", SUPPORT_GROUP);
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles())
|
||||
.containsExactly(DEFAULT_CLIENT_ID, OWNER);
|
||||
}
|
||||
|
||||
/** Admins have read/write access to the authorized registrars, AND the admin registrar. */
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_authorizedAdmin() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
AUTHORIZED_ADMIN, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles())
|
||||
.containsExactly(
|
||||
DEFAULT_CLIENT_ID, OWNER,
|
||||
DEFAULT_CLIENT_ID, ADMIN,
|
||||
ADMIN_CLIENT_ID, OWNER,
|
||||
ADMIN_CLIENT_ID, ADMIN)
|
||||
.inOrder();
|
||||
}
|
||||
|
||||
/**
|
||||
* Unauthorized admins only have full access to the admin registrar, and read-only to the rest.
|
||||
*/
|
||||
@Test
|
||||
public void getAllClientIdWithAccess_unauthorizedAdmin() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
UNAUTHORIZED_ADMIN, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getAllClientIdWithRoles())
|
||||
.containsExactly(
|
||||
ADMIN_CLIENT_ID, OWNER,
|
||||
ADMIN_CLIENT_ID, ADMIN,
|
||||
DEFAULT_CLIENT_ID, ADMIN)
|
||||
.inOrder();
|
||||
}
|
||||
|
||||
/** Fail loading registrar if user doesn't have access to it. */
|
||||
@Test
|
||||
public void testGetRegistrarForUser_noAccess_isNotAdmin() {
|
||||
expectGetRegistrarFailure(
|
||||
DEFAULT_CLIENT_ID,
|
||||
UNAUTHORIZED_USER,
|
||||
"{user} doesn't have access to registrar {clientId}");
|
||||
}
|
||||
|
||||
/** Fail loading registrar if there's no user associated with the request. */
|
||||
@Test
|
||||
public void testGetRegistrarForUser_noUser() {
|
||||
expectGetRegistrarFailure(DEFAULT_CLIENT_ID, NO_USER, "Not logged in");
|
||||
}
|
||||
|
||||
/** Succeed loading registrar if user has access to it. */
|
||||
@Test
|
||||
public void testGetRegistrarForUser_hasAccess_isNotAdmin() {
|
||||
expectGetRegistrarSuccess(
|
||||
AUTHORIZED_USER, "{user} has [OWNER] access to registrar {clientId}");
|
||||
}
|
||||
|
||||
/** Succeed loading registrar if admin with access. */
|
||||
@Test
|
||||
public void testGetRegistrarForUser_hasAccess_isAdmin() {
|
||||
expectGetRegistrarSuccess(
|
||||
AUTHORIZED_ADMIN, "{user} has [OWNER, ADMIN] access to registrar {clientId}");
|
||||
}
|
||||
|
||||
/** Succeed loading registrar for admin even if they aren't on the approved contacts list. */
|
||||
@Test
|
||||
public void testGetRegistrarForUser_noAccess_isAdmin() {
|
||||
expectGetRegistrarSuccess(
|
||||
UNAUTHORIZED_ADMIN, "{user} has [ADMIN] access to registrar {clientId}.");
|
||||
}
|
||||
|
||||
/** Fail loading registrar even if admin, if registrar doesn't exist. */
|
||||
@Test
|
||||
public void testGetRegistrarForUser_doesntExist_isAdmin() {
|
||||
expectGetRegistrarFailure(
|
||||
"BadClientId",
|
||||
AUTHORIZED_ADMIN,
|
||||
"{user} doesn't have access to registrar {clientId}");
|
||||
}
|
||||
|
||||
private void expectGetRegistrarSuccess(
|
||||
AuthResult authResult, String message) {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
authResult, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.getRegistrar(DEFAULT_CLIENT_ID)).isNotNull();
|
||||
assertAboutLogs()
|
||||
.that(testLogHandler)
|
||||
.hasLogAtLevelWithMessage(
|
||||
Level.INFO, formatMessage(message, authResult, DEFAULT_CLIENT_ID));
|
||||
}
|
||||
|
||||
private void expectGetRegistrarFailure(
|
||||
String clientId, AuthResult authResult, String message) {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
authResult, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
ForbiddenException exception =
|
||||
assertThrows(
|
||||
ForbiddenException.class, () -> registrarAccessor.getRegistrar(clientId));
|
||||
|
||||
assertThat(exception).hasMessageThat().contains(formatMessage(message, authResult, clientId));
|
||||
}
|
||||
|
||||
/** If a user has access to a registrar, we should guess that registrar. */
|
||||
@Test
|
||||
public void testGuessClientIdForUser_hasAccess_isNotAdmin() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
AUTHORIZED_USER, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.guessClientId()).isEqualTo(DEFAULT_CLIENT_ID);
|
||||
}
|
||||
|
||||
/** If a user doesn't have access to any registrars, guess returns nothing. */
|
||||
@Test
|
||||
public void testGuessClientIdForUser_noAccess_isNotAdmin() {
|
||||
expectGuessRegistrarFailure(UNAUTHORIZED_USER, "{user} isn't associated with any registrar");
|
||||
}
|
||||
|
||||
/**
|
||||
* If an admin has access to a registrar, we should guess that registrar (rather than the
|
||||
* ADMIN_CLIENT_ID).
|
||||
*/
|
||||
@Test
|
||||
public void testGuessClientIdForUser_hasAccess_isAdmin() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
AUTHORIZED_ADMIN, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.guessClientId()).isEqualTo(DEFAULT_CLIENT_ID);
|
||||
}
|
||||
|
||||
/** If an admin doesn't have access to a registrar, we should guess the ADMIN_CLIENT_ID. */
|
||||
@Test
|
||||
public void testGuessClientIdForUser_noAccess_isAdmin() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
UNAUTHORIZED_ADMIN, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.guessClientId()).isEqualTo(ADMIN_CLIENT_ID);
|
||||
}
|
||||
|
||||
/**
|
||||
* If an admin is not associated with a registrar and there is no configured adminClientId, but
|
||||
* since it's an admin - we have read-only access to everything - return one of the existing
|
||||
* registrars.
|
||||
*/
|
||||
@Test
|
||||
public void testGuessClientIdForUser_noAccess_isAdmin_adminClientIdEmpty() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(UNAUTHORIZED_ADMIN, "", SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.guessClientId()).isAnyOf(ADMIN_CLIENT_ID, DEFAULT_CLIENT_ID);
|
||||
}
|
||||
|
||||
/**
|
||||
* If an admin is not associated with a registrar and the configured adminClientId points to a
|
||||
* non-existent registrar, we still guess it (we will later fail loading the registrar).
|
||||
*/
|
||||
@Test
|
||||
public void testGuessClientIdForUser_noAccess_isAdmin_adminClientIdInvalid() {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
UNAUTHORIZED_ADMIN, "NonexistentRegistrar", SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
assertThat(registrarAccessor.guessClientId()).isEqualTo("NonexistentRegistrar");
|
||||
}
|
||||
|
||||
private void expectGuessRegistrarFailure(AuthResult authResult, String message) {
|
||||
AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
new AuthenticatedRegistrarAccessor(
|
||||
authResult, ADMIN_CLIENT_ID, SUPPORT_GROUP, groupsConnection);
|
||||
|
||||
ForbiddenException exception =
|
||||
assertThrows(ForbiddenException.class, () -> registrarAccessor.guessClientId());
|
||||
assertThat(exception)
|
||||
.hasMessageThat()
|
||||
.contains(formatMessage(message, authResult, null));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testNullness() {
|
||||
new NullPointerTester()
|
||||
.setDefault(HttpServletRequest.class, req)
|
||||
.setDefault(HttpServletResponse.class, rsp)
|
||||
.testAllPublicStaticMethods(AuthenticatedRegistrarAccessor.class);
|
||||
}
|
||||
}
|
||||
|
|
@ -17,9 +17,8 @@ package google.registry.ui.server.registrar;
|
|||
import static com.google.common.net.HttpHeaders.LOCATION;
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static com.google.monitoring.metrics.contrib.LongMetricSubject.assertThat;
|
||||
import static google.registry.testing.DatastoreHelper.loadRegistrar;
|
||||
import static google.registry.ui.server.registrar.AuthenticatedRegistrarAccessor.Role.ADMIN;
|
||||
import static google.registry.ui.server.registrar.AuthenticatedRegistrarAccessor.Role.OWNER;
|
||||
import static google.registry.request.auth.AuthenticatedRegistrarAccessor.Role.ADMIN;
|
||||
import static google.registry.request.auth.AuthenticatedRegistrarAccessor.Role.OWNER;
|
||||
import static javax.servlet.http.HttpServletResponse.SC_MOVED_TEMPORARILY;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
|
@ -28,9 +27,9 @@ import com.google.appengine.api.users.User;
|
|||
import com.google.appengine.api.users.UserServiceFactory;
|
||||
import com.google.common.collect.ImmutableSetMultimap;
|
||||
import com.google.common.net.MediaType;
|
||||
import google.registry.request.HttpException.ForbiddenException;
|
||||
import google.registry.request.auth.AuthLevel;
|
||||
import google.registry.request.auth.AuthResult;
|
||||
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
|
||||
import google.registry.request.auth.UserAuthInfo;
|
||||
import google.registry.security.XsrfTokenManager;
|
||||
import google.registry.testing.AppEngineRule;
|
||||
|
|
@ -56,8 +55,6 @@ public class ConsoleUiActionTest {
|
|||
.withUserService(UserInfo.create("marla.singer@example.com", "12345"))
|
||||
.build();
|
||||
|
||||
private final AuthenticatedRegistrarAccessor registrarAccessor =
|
||||
mock(AuthenticatedRegistrarAccessor.class);
|
||||
private final HttpServletRequest request = mock(HttpServletRequest.class);
|
||||
private final FakeResponse response = new FakeResponse();
|
||||
private final ConsoleUiAction action = new ConsoleUiAction();
|
||||
|
|
@ -76,24 +73,19 @@ public class ConsoleUiActionTest {
|
|||
action.req = request;
|
||||
action.response = response;
|
||||
action.registrarConsoleMetrics = new RegistrarConsoleMetrics();
|
||||
action.registrarAccessor = registrarAccessor;
|
||||
action.userService = UserServiceFactory.getUserService();
|
||||
action.xsrfTokenManager = new XsrfTokenManager(new FakeClock(), action.userService);
|
||||
action.paramClientId = Optional.empty();
|
||||
AuthResult authResult = AuthResult.create(AuthLevel.USER, UserAuthInfo.create(user, false));
|
||||
action.authResult = authResult;
|
||||
when(registrarAccessor.getRegistrar("TheRegistrar"))
|
||||
.thenReturn(loadRegistrar("TheRegistrar"));
|
||||
when(registrarAccessor.getAllClientIdWithRoles())
|
||||
.thenReturn(
|
||||
|
||||
action.registrarAccessor =
|
||||
AuthenticatedRegistrarAccessor.createForTesting(
|
||||
ImmutableSetMultimap.of(
|
||||
"TheRegistrar", OWNER,
|
||||
"OtherRegistrar", OWNER,
|
||||
"OtherRegistrar", ADMIN,
|
||||
"NewRegistrar", OWNER,
|
||||
"NewRegistrar", ADMIN,
|
||||
"AdminRegistrar", ADMIN));
|
||||
when(registrarAccessor.guessClientId()).thenCallRealMethod();
|
||||
// Used for error message in guessClientId
|
||||
registrarAccessor.authResult = authResult;
|
||||
RegistrarConsoleMetrics.consoleRequestMetric.reset();
|
||||
}
|
||||
|
||||
|
|
@ -146,7 +138,8 @@ public class ConsoleUiActionTest {
|
|||
|
||||
@Test
|
||||
public void testUserDoesntHaveAccessToAnyRegistrar_showsWhoAreYouPage() {
|
||||
when(registrarAccessor.getAllClientIdWithRoles()).thenReturn(ImmutableSetMultimap.of());
|
||||
action.registrarAccessor =
|
||||
AuthenticatedRegistrarAccessor.createForTesting(ImmutableSetMultimap.of());
|
||||
action.run();
|
||||
assertThat(response.getPayload()).contains("<h1>You need permission</h1>");
|
||||
assertThat(response.getPayload()).contains("not associated with Nomulus.");
|
||||
|
|
@ -175,8 +168,6 @@ public class ConsoleUiActionTest {
|
|||
public void testSettingClientId_notAllowed_showsNeedPermissionPage() {
|
||||
// Behaves the same way if fakeRegistrar exists, but we don't have access to it
|
||||
action.paramClientId = Optional.of("fakeRegistrar");
|
||||
when(registrarAccessor.getRegistrar("fakeRegistrar"))
|
||||
.thenThrow(new ForbiddenException("forbidden"));
|
||||
action.run();
|
||||
assertThat(response.getPayload()).contains("<h1>You need permission</h1>");
|
||||
assertThat(response.getPayload()).contains("not associated with the registrar fakeRegistrar.");
|
||||
|
|
@ -185,20 +176,18 @@ public class ConsoleUiActionTest {
|
|||
|
||||
@Test
|
||||
public void testSettingClientId_allowed_showsRegistrarConsole() {
|
||||
action.paramClientId = Optional.of("OtherRegistrar");
|
||||
when(registrarAccessor.getRegistrar("OtherRegistrar"))
|
||||
.thenReturn(loadRegistrar("TheRegistrar"));
|
||||
action.paramClientId = Optional.of("NewRegistrar");
|
||||
action.run();
|
||||
assertThat(response.getPayload()).contains("Registrar Console");
|
||||
assertThat(response.getPayload()).contains("reg-content-and-footer");
|
||||
assertMetric("OtherRegistrar", "true", "[OWNER, ADMIN]", "SUCCESS");
|
||||
assertMetric("NewRegistrar", "true", "[OWNER, ADMIN]", "SUCCESS");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testUserHasAccessAsTheRegistrar_showsClientIdChooser() {
|
||||
action.run();
|
||||
assertThat(response.getPayload()).contains("<option value=\"TheRegistrar\" selected>");
|
||||
assertThat(response.getPayload()).contains("<option value=\"OtherRegistrar\">");
|
||||
assertThat(response.getPayload()).contains("<option value=\"NewRegistrar\">");
|
||||
assertThat(response.getPayload()).contains("<option value=\"AdminRegistrar\">");
|
||||
assertMetric("TheRegistrar", "false", "[OWNER]", "SUCCESS");
|
||||
}
|
||||
|
|
|
|||
|
|
@ -86,10 +86,11 @@ public class RegistrarSettingsActionTest extends RegistrarSettingsActionTestCase
|
|||
public void testFailure_readRegistrarInfo_notAuthorized() {
|
||||
setUserWithoutAccess();
|
||||
Map<String, Object> response = action.handleJsonRequest(ImmutableMap.of("id", CLIENT_ID));
|
||||
assertThat(response).containsExactly(
|
||||
"status", "ERROR",
|
||||
"results", ImmutableList.of(),
|
||||
"message", "forbidden test error");
|
||||
assertThat(response)
|
||||
.containsExactly(
|
||||
"status", "ERROR",
|
||||
"results", ImmutableList.of(),
|
||||
"message", "TestUserId doesn't have access to registrar TheRegistrar");
|
||||
assertNoTasksEnqueued("sheet");
|
||||
assertMetric(CLIENT_ID, "read", "[]", "ERROR: ForbiddenException");
|
||||
}
|
||||
|
|
@ -160,10 +161,11 @@ public class RegistrarSettingsActionTest extends RegistrarSettingsActionTestCase
|
|||
"op", "update",
|
||||
"id", CLIENT_ID,
|
||||
"args", ImmutableMap.of("lastUpdateTime", getLastUpdateTime())));
|
||||
assertThat(response).containsExactly(
|
||||
"status", "ERROR",
|
||||
"results", ImmutableList.of(),
|
||||
"message", "forbidden test error");
|
||||
assertThat(response)
|
||||
.containsExactly(
|
||||
"status", "ERROR",
|
||||
"results", ImmutableList.of(),
|
||||
"message", "TestUserId doesn't have access to registrar TheRegistrar");
|
||||
assertNoTasksEnqueued("sheet");
|
||||
assertMetric(CLIENT_ID, "update", "[]", "ERROR: ForbiddenException");
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,13 +17,11 @@ package google.registry.ui.server.registrar;
|
|||
import static com.google.monitoring.metrics.contrib.LongMetricSubject.assertThat;
|
||||
import static google.registry.config.RegistryConfig.getGSuiteOutgoingEmailAddress;
|
||||
import static google.registry.config.RegistryConfig.getGSuiteOutgoingEmailDisplayName;
|
||||
import static google.registry.request.auth.AuthenticatedRegistrarAccessor.Role.ADMIN;
|
||||
import static google.registry.request.auth.AuthenticatedRegistrarAccessor.Role.OWNER;
|
||||
import static google.registry.security.JsonHttpTestUtils.createJsonPayload;
|
||||
import static google.registry.testing.DatastoreHelper.createTlds;
|
||||
import static google.registry.testing.DatastoreHelper.disallowRegistrarAccess;
|
||||
import static google.registry.testing.DatastoreHelper.loadRegistrar;
|
||||
import static google.registry.ui.server.registrar.AuthenticatedRegistrarAccessor.Role.ADMIN;
|
||||
import static google.registry.ui.server.registrar.AuthenticatedRegistrarAccessor.Role.OWNER;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
||||
import com.google.appengine.api.users.User;
|
||||
|
|
@ -32,12 +30,12 @@ import com.google.common.collect.ImmutableMap;
|
|||
import com.google.common.collect.ImmutableSetMultimap;
|
||||
import google.registry.config.RegistryEnvironment;
|
||||
import google.registry.model.ofy.Ofy;
|
||||
import google.registry.request.HttpException.ForbiddenException;
|
||||
import google.registry.request.JsonActionRunner;
|
||||
import google.registry.request.JsonResponse;
|
||||
import google.registry.request.ResponseImpl;
|
||||
import google.registry.request.auth.AuthLevel;
|
||||
import google.registry.request.auth.AuthResult;
|
||||
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
|
||||
import google.registry.request.auth.UserAuthInfo;
|
||||
import google.registry.testing.AppEngineRule;
|
||||
import google.registry.testing.FakeClock;
|
||||
|
|
@ -134,34 +132,25 @@ public class RegistrarSettingsActionTestCase {
|
|||
RegistrarConsoleMetrics.settingsRequestMetric.reset(clientId, op, roles, status);
|
||||
}
|
||||
|
||||
/** Sets registrarAccessor.getRegistrar to succeed for all AccessTypes. */
|
||||
/** Sets registrarAccessor.getRegistrar to succeed for CLIENT_ID only. */
|
||||
protected void setUserWithAccess() {
|
||||
action.registrarAccessor = mock(AuthenticatedRegistrarAccessor.class);
|
||||
|
||||
when(action.registrarAccessor.getAllClientIdWithRoles())
|
||||
.thenReturn(ImmutableSetMultimap.of(CLIENT_ID, OWNER));
|
||||
when(action.registrarAccessor.getRegistrar(CLIENT_ID))
|
||||
.thenAnswer(x -> loadRegistrar(CLIENT_ID));
|
||||
action.registrarAccessor =
|
||||
AuthenticatedRegistrarAccessor.createForTesting(
|
||||
ImmutableSetMultimap.of(CLIENT_ID, OWNER));
|
||||
}
|
||||
|
||||
/** Sets registrarAccessor.getRegistrar to always fail. */
|
||||
protected void setUserWithoutAccess() {
|
||||
action.registrarAccessor = mock(AuthenticatedRegistrarAccessor.class);
|
||||
|
||||
when(action.registrarAccessor.getAllClientIdWithRoles()).thenReturn(ImmutableSetMultimap.of());
|
||||
when(action.registrarAccessor.getRegistrar(CLIENT_ID))
|
||||
.thenThrow(new ForbiddenException("forbidden test error"));
|
||||
action.registrarAccessor =
|
||||
AuthenticatedRegistrarAccessor.createForTesting(ImmutableSetMultimap.of());
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets registrarAccessor.getAllClientIdWithRoles to return a map with admin role for CLIENT_ID
|
||||
*/
|
||||
protected void setUserAdmin() {
|
||||
action.registrarAccessor = mock(AuthenticatedRegistrarAccessor.class);
|
||||
|
||||
when(action.registrarAccessor.getAllClientIdWithRoles())
|
||||
.thenReturn(ImmutableSetMultimap.of(CLIENT_ID, ADMIN));
|
||||
when(action.registrarAccessor.getRegistrar(CLIENT_ID))
|
||||
.thenAnswer(x -> loadRegistrar(CLIENT_ID));
|
||||
action.registrarAccessor =
|
||||
AuthenticatedRegistrarAccessor.createForTesting(
|
||||
ImmutableSetMultimap.of(CLIENT_ID, ADMIN));
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue